Exporting Audit Logs to Amazon S3 (SIEM Integration)

Pylon can automatically deliver your organization's audit logs to an Amazon S3 bucket you own, on a recurring schedule. This is the easiest way to feed Pylon audit events into SIEM tools that ingest from S3 — Splunk, Datadog, Elastic, Sumo Logic, AWS CloudTrail Lake, Athena, and others. Unlike the pull-based Audit Logs API, no polling scripts or cron jobs are required.

Prerequisites

• Enterprise plan (audit logs feature required)

• Admin access in Pylon to configure the export

• An S3 bucket in your AWS account and permission to create an IAM role

How It Works

Pylon assumes an IAM role in your AWS account (using an External ID generated by Pylon) and writes gzip-compressed JSONL files to your bucket on a schedule you choose: every 5 minutes (default), hourly, or daily (at a UTC hour you pick). The first export backfills your complete audit history from your organization's creation; subsequent runs deliver only new events. Runs with no new events do not write a file.

Step 1: Copy Your External ID from Pylon

Go to Settings > Audit Logs > Sync to S3 in Pylon and copy the External ID shown there. Pylon generates this value for your organization — you don't create or enter one yourself. It must be used exactly as shown in your IAM role trust policy below.

Step 2: Create the IAM Role in Your AWS Account

Create an IAM role that Pylon's export service can assume.

Trust policy — replace YOUR_EXTERNAL_ID with the External ID you copied from Pylon:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::825765419603:role/S3ExportServiceRole"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "YOUR_EXTERNAL_ID"
        }
      }
    }
  ]
}

Permissions policy — only s3:PutObject is required (replace YOUR_BUCKET):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::YOUR_BUCKET/*"
    }
  ]
}

If your bucket uses SSE-KMS encryption, also grant the role access to the bucket's KMS key:

{
  "Effect": "Allow",
  "Action": [
    "kms:GenerateDataKey*",
    "kms:Decrypt"
  ],
  "Resource": "arn:aws:kms:REGION:YOUR_ACCOUNT_ID:key/YOUR_KEY_ID"
}

Step 3: Configure the Export in Pylon

1. Go to Settings > Audit Log Export.

2. Enter a name, your IAM role ARN, S3 bucket name, and AWS region. The External ID is generated by Pylon and shown on this page — there is nothing to enter for it.

3. Choose a cadence: every 5 minutes, hourly, or daily (with a UTC sync hour).

4. Click Test Connection. This writes a small probe object to _pylon/connection_test in your bucket to verify the role, bucket, and (if applicable) KMS permissions. The probe is overwritten on each test and never deleted, so s3:DeleteObject is not required.

5. Save and enable the export.

File Format and Layout

Files are gzip-compressed JSON Lines (one JSON object per line) written to:

date=<YYYY-MM-DD>/sync_timestamp=<time>/definition=<id>/audit_logs_<page>.jsonl.gz

Each record matches the Audit Logs API schema, plus a top-level "version": 1 field for forward compatibility. action_happened_at is the event's business timestamp (RFC 3339, UTC).

Ingesting Into Your SIEM

• Splunk — use the Splunk Add-on for AWS (Generic S3 or SQS-based S3 input); gzip is decompressed automatically

• Datadog — use the Datadog Forwarder Lambda triggered by S3 object creation

• Elastic — use the Elastic Agent AWS S3 input (SQS notification recommended)

• Sumo Logic — use an Amazon S3 source

• Athena / CloudTrail Lake — query the files in place; the date= prefix works as a partition key

Most tools auto-detect gzip; if yours doesn't, configure the source for gzip-compressed JSON Lines.

Monitoring and Troubleshooting

• The settings page shows the export's health, most recent error, and a run history table (run time, data window, rows exported, status).

• After 3 consecutive failed runs (e.g. the role was deleted or permissions revoked), the export is automatically disabled. Fix the AWS-side issue, use Test Connection to confirm, then re-enable.

• Access Denied errors — verify the trust policy principal, the sts:ExternalId condition exactly matches the External ID shown in Pylon, the s3:PutObject resource covers your bucket, and KMS permissions if the bucket uses SSE-KMS.

• Failed runs are retried automatically; no events are lost as long as the export is re-enabled.